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(57) Abstract: 
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PURPOSE: A network based 
intrusion detection system is 
provided to actively block and 
disturb the attempt of hacking 
irrespective of the configuration 
of a network when network 
intrusion such as hacking, 
service attack, and scanning is 
sensed. 



CONSTITUTION: A monitoring 
NIC(Network Interface Card) and 
response NIC(1 10) collects a 
packet of an analyzing object 
traffic from a network 1(200a), 
and transmits a packet for 
performing an SNA(Suspicious 
Network Activity) and a session 
kill to the network 1(200a). A 
monitoring NIC(120a) collects a 
packet of an analyzing object 
traffic from a network 2(200b), 
and a response NIC(120b) 
transmits a packet for 
performing an SNA and a 
session kill to the network 2 
(200b). A monitoring NIC(130a) collects a packet of an analyzing object traffic from a 
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network 3(200c), and transmits a packet for performing the SNA and the session kill 
to the network 3(200c) through the response NIC(120b). 
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^ UIM*I3 SSg-XI Al^iJOl! U|eo, B ^ ¥Ei ^/hq{m e^sjoj fl^s ^gofb HL|Eli!(MN : Monitoring) NIC , U| 

e«3£ M±n\M± U|E^|a ™ElblEI(SNA : Suspcious Network Activity)0j| CUtl Q\W ^ (Session Kilt)» ^iJo^l m^M S 

LH^ S« (RN : Response) NICM ^blSfi, CH UOPh OIE-IJHSI 2LIHS NIC0I ^BH^ (Traffic) ^i5[2 2ie S?, OiSH^HSJ SLIEH 

ij NICOI §^ Nice »U«! }HI£S* ^21 §S Nice ^ Hf^ Afgof^U S«6J£«I SIN, §e NIC3I- Ul^?-I3^ ^(Packet 
)8 SUiXj =5[b §?, RN0I MLHiz: HH^OII CHoH £}^§J (Routing )B 4* SB 6H i& ^I0|^?-||0| (Response Gateway) £ Afg« ^ 

?JL^m »o^M| 6HU0IU AH tl| S^, ^3>Hy g°| U|eo| B |ioi § ij-XISie CCII, Liie^Bo, zp^oi CH S I 3 CH Si ^ II 0|| &B«0| ^£6|- 
>il oHU AIS0II CH6H 3§^1^ CHXHK 4* SiOi SHUOil CH oH ^^51 5x| 6^1 £6fe SIS B 4> 0JE-I3H2I UI^?-|3S UAIoHOt 

6 r fe «»6K)||A|£ UlfeOI S*f8MI ^§5f£^ fi 3010. 

CHSSE 
£2 

Lil^?-|H SSBXI AI^B(NIDS), UiM?43 eiHMOl^ ^E(NIC) 
SAilAI 

£ 1 g M?-IS°h0l X|$!£|^ L2 ^¥IXlS AFgt! Si^joj AI^US] 
£ 2 te S tt90|| CTJ^ UIM?-!3 SeJ»XI Al^^jSI 8! ^AIOIIS £A|» 

£ 3 ^ s oil mm ui^^ib m°*mx\ ai^ssi se urn ^aioiis eaik 

£ 4 fe e Oil dfE Lll^a H2J2JAI A|£:B2| ^§ JWQ.E. 

^fi¥^0ll CHB 
100 : UIM?-|3 liSirXI 110 : 2J EH fill 0| ±3\El 

120a. 130a : SUH6I NIC 120b : NIC 

200a : UIM?-I31 200b : UIM?-]32 

200c : UIM?-i33 300 : §S >II0|M?I|0| 

S UIM^B S'^^XI Al^gOil 36} 225, ^61. bJ|e°|B0il 
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WIPS PIView 3.3.2.G 



o°l'Ii IMISfOj 01 M ^BotE^ offer UIM^ja SeiSXI A|^|iJ(NIDS : Network Based Intrusion Detection System)0|| ?i0i/H2J Ui§?| 
3 e! EH HI 01 ± 5>|E ^P^Oil ^SSIfe 3J0ICK 

UIM^a &iJ8X| A|±g(NIDS : Network Based Intrusion Detection System) g HIM 31 3 Oil m^t= ag e eh sj (Traffic) 8 ^8KX ^mo\ 
>iU, ¥|g 2^g0| 91^ m$\mm m*\o[0\ 01 § »e8^ f 3B| ^Oil^l »afc 3|^e S^6[b HOICK 

&}| B?\\ ^ J[X\ UVIQK 6IUh AH^HIA^ UIM?-iB ^ El til El (SNA : Suspicious Network Activity) S* ¥^fe 3S££. *jo fcg 

HI MSI 3 AH til ^ ^SxllX-|| S# AHbl^ >1¥ g TCP/IP2] 3^3 21 ^^§1 0|g» "^^ Bj|gj ±=JHy/0^(Low Level 

Scanning/Attack)"OII Q\m ^oHH 6fe 3¥0|3, 6|L[fe Ail£ IJ (Session KilUOIBf ¥^^r SISS S^IM A|£»te TCP 211 

SSIS 33 0ICK 

01 ¥^XIfe S¥ 2[§I 512^ B^SOIS! EH ^(Packet)e 8H& LHMSI3 £fe S^M(Host)OII MLH^o^Mi 0l¥0H£!CK 

DM, 6PI UIMSI3 ^EItilEI(SNA) g Aii£ S (Session Kill) S¥ HI MSI 3 SJEJ^XI A|^H(NIDS)0| oHS Ml MSI 3 ^ S^MOII HH^M S 
y ^ SiCHO^oi- Ol^Oi^ ^ »CK 

£ 1 S (Forwarding) °}0| XISEI^ L2 r^SixIS A^gol-OI 2e^2J Slgj9XI A|^U2| &m Q&M fEAle!- 2 0ICK 

HI MSI 3 S£J§«| AI^H(NIDS)^ HIMSI3 eiElffllOl:^ ?fH(NIC : Network Interface Card)S Olga^OI UIMS|3M¥H HH^iM ^OfMOj, 3 
LH§M ^o[2, 12!} EH^ SLH ^3 AJ|£ (Session)M ^Xil A|3|^ e^i ^§1 5^1 MWHCK 

£0 011 £A|oh LilMSIB ojEHIHIOI^ ^E(NIC)fc 6PI DIMS! 3 S2IBXI A|£B(NIDS)OII OjBUH 2iM 4>£ SID. 

3S-ILK H|E?a ¥^0il Site Sb|£| ttH^Oil UIMSI3 glHffllOI^HHMICp* UIMSI3S HJj^lM ^ Slfe: S^OII^ L-||MSI3 
El til El (SNA) W Ail <^ ii (Session KilOS ^ty! v 4= SICK 

0|EH§[ S^^^ UIMSiB §o.gj| A|^ii(NIDS)0ilAH HH^i(Packet) 4S§°J NIC (Monitoring NIOS Sfie UIMSIB SH|2| SM(Portph 
nH^!(Packet)S £!B8H ^^I0l Dl H (Mirroring)OI OhH S (Forwarding) ei 0\\M m ^ 

o\ w, m^im ^o\mo\\= uim^ib oiE-nnioi^3^(Nic)2f smb Liie?-ia pjEiniioi^3fH(Nic)Pf §?, lm^b. m&mx\ ai^iknid 

S)9\ Hl§?a oi E ^|0|^ = 3^H(NIC)^¥E-i Ul^o^Ahoj £ o, g (Forwarding) 0| ^§3 SM(Port)^ IH^M am^l £|H. 3 HH^OI Lj| 

M?.jaoii s^ohxi smoi mo\x\ 



^^01 Ol^HXf ofe 31^1 

^ ^Sg ^^l£f ^XilSM 6H26^| ^16^01 ^2^, UIM?-JB 5fH?-j|OiH] s^lM ^^6f01 6HU0IU AHtil^ >,3Hy § 

Lil^?-J3 SSI ^IlfHS CH, U|eoj 3 oj zp^oi CHg^l S CH ^^XIOII ^E^SIOI 6HU A|£0il Q\m X\& §J ^oH« fJ- 4^ 

LilM?-|B SEJ^XI A|^ij(NIDS)S XII g^M 3 ^^^^ ehCK 

^ ^S£J S£ CfB 03 Ej DW2\ EH Packet) 4S§ NICOl ^ XH of H SI £ , NICOI ^j^oh §g NICM ^fXICH, 3 ^gOI aS£|£^ 

IT ^ Slfer Ijoj^XI A|>i^(NIDS)§ Xllgof^ ^0|CK 

aS ^^iS ^^5^1 ^I§1 ^ ^^011 U|^?-jB Sj^i^XI Al^iyoj ^ ^^0|| CC^S, ^ g^gOil CH^ UIM?jB ^°J1[X| Alr^g^ 
Li|E°j 30 il 2^ MBH^I (Traffic) S ^^6f01 ^ISSf>|LK ¥|g ^f^^OI I^^IMM ^X| SfOI 0IM L1|eo| 3 °^EI d| El (SNA) SI Aj|<M 

^(Session KilDM 4^188^01 »B ^ ^Xloffe L1IM?-]B H^J^XI A|^g(NIDS : Network Based Intrusion Detection System)0|| SlOiAH 

, UIE9I3 SaBXI A|^S(NIDS)0| UIM?-jBM¥E-i S^CH^ MEH^Sj HH^iM ^SSJte SUEia NIC5K U|M?.JB^ LM^B 9!jElblEI 
(SNA) S Ail^ ^(Session KiN)S ^S6PI MZim SLHfe e& NICM; S^6^ ^0H£ 6fU OI^Hj XII 1 §2] UIM?-JB ojEiSilOl^ 9fS 

s weoii (ifE uim^ib s'^'^xi ai^shi otAhojj a>^pj, ^ ^goii mm uim^b m&mx\ M±m& lm^b^ei ^ch& ^ 

2H^"°J nH^e 4S8^ eLIEiH NIC StH^ OI^CH^l ^0H£ otU 0|^£J XII 2 §£l IM^¥\B 9JE-HHI0|^ 3\ELM EH S^oFfe 

s ^soii mm ui^?4B g^^xi ai^usi ^^oii if^s, ^ ^soii oc^ l-hm^b g^^xi ai^^isj ^oi xii 2 121 Lne?^a ej 

E^I0|>^ d\^tz M 1 S2j Lil^¥-IB ojEiiiJIOl^ B\^S\ NIC g OH^ 6[L[I g^Sfa, 6HS i& NICS XII 2 §2J U|M?-IB 

2J EHlHIOIr^ 3tHH| Lil^ojB^oj g &0l | q|s| ^ggaf St^l^Oll SjoH ^,^1 XII 2 «2| UI^-IB eiEISilOl^ B\^3\ 2L|Eil! NICOI 4SS| 
UH^OII CHe[ IIH?i# ^^1 IS Nice #6H Lil^?-]B^ SLH^ s^EI. 

^ oil me ui§?i3 us^xi M±ms\ ¥^21 %&ou w^&, ^ ^soii elis ui^^b s»sj^ji ai^^s &d\ ^o\e. b\l\ 01^21 e 

B NIC^^^e^ U|e?|B^ UIM^B °» El til El (SNA) SJ Alia ^(Session KilDS 4-iJSPI ?j§f DH^ee SI ?§ (Routing) 6f fc §& 

^|0l^^|0l(Gateway)S CH 5^6[b 31 °[Cf. 

S IJgOil die Ui^?-I3 USJ^XI AI^S'21 ¥^^2J ^^Oil Q|2S. g ^SOil UI^?4B H^'gXI AI^HS XII 1 §j£| Ul^?43 9J 
EimO\±B\E:S\ eUEiij NICH} gg NICOI S-'flioj sS2S s|Cf. 

B ^SOil [Ifg UIM?-|B S^^XI A|^gj£J ¥3^2" ^^Oil CEf^S, g ^gOil [IfE UIM¥-]B US^XI AI^HS ^>^l Xj| 1 gS| L||M?4B PJ 
ElfiHOI^fHSI eUEIij NIC3I e& NICOI 2f2| ^SI£J0i >iS |§25 e^P. 
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OloK £31 &Zo[0\ }|ir£l8 8 »g£| bH^§r A, A|0j | M mm ^ mgf g gIf ^ f sqis^I 0loH6tB XHe!^ 4 £12H[ &AH6I ^ 

2 2 8 ^ ^SOil dfE U|eo| B goi^ Z | Al^gj{NIDS)2j ^A|0||M 2A|§]- 20ICK 

2^011 2A|°f bf2HT0| 01 ^A|0j|0ilAi^ UI^-iB 5)£mX| A|^S(100)8 3JH2I ggJIJXI 511 ^tJloHQ 

OloK Li|EO| a ^ ¥Ei -AjQjAh e^rno] MZim Lj|^?.]B °J EH Hj|0| ^5>[2M 2UEiiy(MN : Monitoring) NIC , Li|eo| B ^ bjieo^ 

^EIHIEI(SNA) §J AHI£ IMSession KilDS <4®6PI flff IIH^S MLH8 UIM?-IB 9J Ei 211 01 ^5>f2» §£r NIC (RN : Response NIC)0|Ef »CL 

SiyttH 218 UI^?-lB1(200a)S¥Ei »*ICH# M£H^2J HH^IS ^S5fb 2L|EHg NIC3f t LHI MSI B1 (200a) S UIM?-|B <™ El U I El (SNA) S! 
AHI^ S (Session Kill)S =4S6PI ?|S EH^IS SLH8 S9 NICS =?&oW o[U2\ 21 HMOI^HO 10)M 2L|Eig NlC^f SB N 

IC Sj»8 Sbl6f£^ B 330ICK 

^, 0| 218 fe^l U|eo| ai( 2ooa)S¥Ei i^el UI^^B £j EfffllOI^HB #6H ^*JCH£r ^BH^!2J IIH^!M 4S6f2 ( = SJ°[ UIM?-IB &] 
EinilOI>r 5^2(1 10)« e§H &3| HI M?4B1 (200a)^ UI^?4B ^ El bl El (SNA) §J AHI£ (Session Kill)* *4§6PI «ff HH3JS 

^ejKH 21c Ui^?-l32(200b)^¥EI «£JCH& M£H^2| MZim ^Sofb SUEiS NIC(120a)3r, Dl MSI B2(200b)M L1IM?-1B e»EldlEI(SN 
A) §y AHI^ ^{Session Kill)S ^mo[D\ 2H^!S SLH8 IS NIC(120b)S ^2M 3J0IEK 

^, 0| 218 &3| UIM?-IB2(200b)^¥Ei 2LIEHH NIC(120a)S mm 8^01^ M£H^2] HH^M £>0| 2LIHS NIC(120a)Hf ^2 

S §& NIC(120b)« mm &J\ L1IM?-iB2(200b)^ LHIMSIB ^EIblEI(SNA) S! AHI<^ ^(Session KilDS ^mo\D\ SH^IS 2fc«CK 

AHI £j M 218 L||MSiB3(200c)2M¥EI S^OIfer ^£H^2| HH^§ 4S6fb SUEifej NIC(1 30a)2MEh =?&EI1L, IHIMSJ B3(200c)^ LH^SI 

3 ^ Eld I El (SNA) §J AHI^ ii (Session KilDS 4*«SPI % » HU^IM MIH8 S3 NIC(120b)M ^>OI g^^E^ ^?^§[ 50 1 Of. 

^, 0| 218 £^1 UIM?-JB3(200c)o^«E-| SUEiii NIC(130a)S S6H ^^Dl^ HH^ie 212J NIC(1 

20b)ff mm L-ll^?-jB3(200c)2^ UIM?-J3 ^EIblEI(SNA) ^ ^(Session KilDS ^^6PI IIH^e StUEK 

0| IH. S^Sfe NIC(120b)8 ^^l 2UE1H NIC(130a)2| ^SOil PIB §S§ ^^iH ^OHO^ g,^2g IIH^g 4 

a p. 

£38^ ^soii mm m§?a u^j^xi ai^^(nids)°i 2 die ^aioiis £aib ^ioiek 

0I ^AI0||0||/d^ i& >ilOI^?-l|OI(300)M AFgoW HH^OII E^H (Routing) 0| P^6h2^ §[ 50IEL 

^, 01 S^Oil^ b||eoj3 SEJg-XI Al^:gj(100)£| §e NIC2^¥Ej ^#2J^ UIM^-IB ^EIblEI(SNA) §^ All^ IJ (Session KilDS 4ISSPI 

?l°[ nn?je §s >iioi^?-jioi(3oo)m §5H a^iia^ l-iim?4b^ s^^^^am ezi E.^121 Lu^^BOii nics 2Si 4 si^ fe^oi^u. ui 

M?-iB ^»0| eXI aCHBfS. Eh¥E-i(Router)£j ^^(Ml d^Ef g&OI ^^6^2^ 3J0ICK 

^>0| U|eo, B ijo.^ji Al^^'8 ^,01 ^ SMOil CH6H £UEi^ NlCif §S NICS ^X]CH CH CCH & ^^125 DH^S S^XIM l§5f2, 
1§S ^^011 df^ HH^iS SLH^I ?|6f01 E'fi^ Oil MM 01. IlH^iS MLHUX^o^ S^£J^ DH^I Oil §^,oj ^2?JIOi ^^ei 

XI £| MAC(Media Access Control) Oi^&I^M 4SehCK 

^§ LHgOil (IfEh OH 2 NICS e^H EH5JS SLH^ia^XIM ^§6^01 =^X|2] MAC OHHSil^^ nH^S StdEK 

01 EH 3! (Ethernet) tfSSFOilAH HH^iS L1l^¥-jB ggj^XI A|^S2^¥Ei ^^^(Host)Oil £^6MI o^l ^loHAi^ =^XI°I MAC OiH£|l^ 
(Media Access Control Address)* tfOKNE} 

0| °ij(MAC) CHHai^b DIE L1IM?-IB^ IIH^S SLH^I ^IB ^IOiM?JIO|^ 42 ^8 0|CHy|2] AH MS! (Subnet) Oil 2^£j0j 

S| MAC OHHEII^ ^ 42 

i& NICOI SLHfe iH^BI MAC CH2ai^M XIS& tCH2 bl^o^l IP ^±9\ 2*1= ^3 ^^^2] MAC CH2ail^M A^^ 4 2 m 
S NIC XF3I2] MAC OH 231^:^ 42 SiEK 

01 28 518 U|eo| 32 | ^^£JCH ^EHS ^1^2^ &S5H0^ o^l 08011, ^§2^ UI^?-iB =?£m mHo[0\ ^§oMI 9C[. 

MAC CH2eil^^^ Af§2J^ g|§ U^CH MS. #^X| MAC OH 231 ^(Source MAC Address) 2J- ^^X| MAC OH 2 ^(Destination MAC Addr 
ess)^ B^l 4 21 EL W^Xl MAC CH23I^^ GH5L!(Packet)S SLHirr NIC2J MAC 4^01^2. =^X| MAC 01231^ HH 5L! (Packet) M g> 
8 NIC2J MAC 4^01 Cf. 

RNOI SH^i (Packet) S CH AfgoF8 S^XI MAC OH 2 31^8 3 ^hXI^ 4 2iEI. *!«}|8 B!£H2] MAC Oi2£il^M A|-g6^8 3^^, 01 
3^8 (01IS MO]) CHOI 51^ (Dummy Hub) Oil ^ ^ 21 OH °[8 §¥0|Ef. CHOI 5iM8 MAC OH 231^011 2|6H O^^j S^S g>XI a^l ttH80il, IP 
4^011 01^8^8 MAC 0i2ai^M M§3K)12 ^^01 SICK HI £1 AH , ¥2*g0| SB] gi2^ ^£H2j MAC OH 2 91 Mg6f8 50| D\™ §8 

^soia. 

SJW8 X^l XF<mo| MAC CH2ai^M Mg6f8 01 3^8 (Ojlp MOH) L2 ^51 Oil 2^QCH 2iM S¥0|CL L2 ^?|X|2J MAC 01 

231^011 0>Et ^?j*]oPI OH 8 Oil EfE g^EH2| MAC 0H2ai^M M§t 8^Pf ^ ±X\D\ BEHU. MAC CH 2 91^21 SXI 

6F8 28 S^'^X|A|^g(IDS)OIU g>^^ (Firewall) ^01 gXH^ 3^ Oil 8 0|g^| XPI Xf<M2| MAC 0H29I^S Afg^ 4 giS 3^2 

2i2U, 01 (T}]0il8 SH& NIDSU ^( Firewall) Oil M B ^I^S «l^6 r I2 Afg^ 4 
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S2|S| MAC CHEfll^M A[§6ffe m^m ^ S&br gfidl 2J6H ^§s| MAC CHEBil^M AFf§6H 0\2j 8ft S^OIEf 01 CEHb 

A r gW MAC CHE^M X|§5H ^OHO^ »Q. 

RNOI Packet) M Si CCH AFgorfe = *!XI MAC^fe 3^1 Ail D\X\ 0|Q. Sib ^£H2] MAC OiE&il^g AFgS^fe g5*£, 01 §^br CH 
□ I dl^(Dummy Hub) Oil 2^£I0H 2ibr S^OICK CHOI oiH^r MAC CHSai^iOtl 2I6H 0F¥^ 3§i g>XI ttH^Oil, IP 4^ Oil [«§o^ MA 
C CHHEII^S Af§o r 01£ £r^0| gJEK CLrEfAH, ¥^§0| S oj 2i£^ MAC OlEBil^M AFgofe 5! 01 &S0IO. 

eflHbr :>il 01 M?ll 01 (Response Gateway) MAC CHEftl^S Af§6^ g& ^lOIM^IOlM 3^ IP 01 CH £ 

t^oPI A^(Mapping)# xHSIofe ARP(Address Resolution Protocol) §S1 XH546l£^ oHO^Ol, 01^1 AH £CH£! ^lOIM^IOISJ MAC 

oinai^M ^xi mac che^i^ A^ea^oj mzim 2^s^i sck 

3!aHbr MAC 0\^3\±m M§ofe ^^el- ^^ Eb HfiOII 2J6H MAC OHHSII^S AFgoHO^ Srbr S¥0|Cf. 01 CLHfe 

AfgW MAC CHEBil^S XI§6H ^CHO^ °fCK 

e oil ah oia-pH3 sue-iu nicoi e^n. ( TraffjC ) -ah^ ^sam 91m 3^, oia jhhi euEi^ nicoi ^ §g Nice 6m *i ^xijii 

SCK 01 3^011 ofUSI NICOI 01 eH^H^J NIC Oil QioH 4> £l^o^ z|Z|oj § d N|C g s^h 0I&2J 2UEIS NIC Oil CH6H 

m& mac oinai^g s§6ib 9ni2 ?±o\oi 

m&m Q¥b 518 Z10II 2^ SUE^ NICOil CHt^ MAC OiEBil^ 2EI JrXIDl, g& 2S0I MOi^g ttH, 6HE+ esoi CHS 

MAC CHHBil^M AFgatiOr- orbrXIS 1§5[}]| SCK Olb CH 2 2L|Ei^ NICM S^6K)1 ^Oi8 ^ ^ (Traffic) 2JXie ^01 y^^MI MA 
C OiEBil^S 9CK 

£4^a ^§0i| [Tje L-||M?-!H §S£JA| Al^g£| g§ .HSUii JHfiSOIP. 

S^(n) OHUXHB 2^1 If SIIH ^Xf°| Ail U (Setting)g (File) E£b £ilXI^£l (Registry) ^¥ EH ^'CHMOUH Af§& NIC(n) °J^^(ln 

stance)S 3s:>l£f AIH ttH, Zl ^MOil ttrE-r ifi^ Jl^tlEL 01 J|^£! SSMOil 2\B\0\ 2i(n) OHUXH^Ei EH^iM MLOC^ Q 

§01 A|, 6H^m^ NIC(n) 21±*e\±3\ CHdi^ S^?-||CH AfgofOI HH^iM 4^ Si^XIM 2§9 4i6[}|| E1EK 

HrPA-i, ^^l£f ^01 Ho|| o|6H LilM?-j3 §b|£| XHI &- CH^Oil ™m5\ 2ximxi SShbr ^§ il^^ & 4^ §A|Oil 01E1^H£I 

^A|6H0^6^ ^W^OilAHE S^roF^il ^A| **™m ^ Sib ^Si ^ ^S°J 4- Si^il 3D. 

01^ Oil AH dF£h^^ ^ ^SOil CC^ UI^?4B U^J^AI Al^gj^ L1l^?^a o^H?li0i2J H.^IS ^^5^ 6HU0IU AH til ^ g^, 

y e^l Ul^?43 gSi i^XltJie ffH, U|eo| 3 oj zp^ 0 , CH S ^H! a OH SibAIOll ^>^SlO| 6HU AlEOil CH oH EH xH 4^ 2iCH SHtJOil 

□ioH ^^oi £xi6ni ^8\t= mm m±m m ^ mMou m^vw9] ui^?-]3s ^aisho^s^ ^#6^ojiAH£ s^a^i ^ai^ ^ ^ 

^ ^¥£! £31 S^SrOt dH^& ^AlOjlM g^^^ 9i^£J^X|°j- SSXra^ 0|EH°h D\M^^E\ ^^§¥^^|Oil HJ 6H 5. 

msocz ¥ ^cH^oi sioi a&m &mo\ j\^mot^ s^sfck 

(57) S^t 
1. 

UIM?-I30il e= ^£H^(Traffic)e ^^6^01 ^igB^XU, J^£OI 91 1: S^IMM l, k X| 6^01 OIM Ul^?-|3 ^EIdlEI(SNA) ^ Ail<^ 

^(Session Kill)« 4-^6^ oHUM XFB ^! ^X|6^ L1l^?-ia ij^JirXI A|^^(NIDS : Network Based Intrusion Detection System)Oil &10HAH 

ummn sasxi ai^bomidsjoi: 

LilM?IB^¥EH ^^□^ ^EH^i^l mZim 4S6fb 2L|E^' NIC3}; 

LHIM?43S Li|Eoj 3 oH E |b|E|( S NA) ^ Ail<^ ^(Session KilDS 4^^S^| EH5L!e SL4i^ NICM; 

5lo[^ ^0H£ 8m OI^HJ XII 1 m°\ Ul^?-|3 oiEJiUIOI^ 5^6ib 31 6^ Ul^?-13 SSirXI A|±ij. 

S?S2. 

mi 1 eroi sioHAi. 

^Ol Ul^o| B sojSXI A|^H(NIDS)0.|: 

uiEoj 3 ^« Ei » /h Q| aj. E2||nio| m ^ m euEiii nic ei^^ oi^oia ^ch£ 6m 01^21 mi 2 ^si nie?ia ejEiniioi^ 3fem 

EH ££T6U=: 31 UI^?-IB SS^XI A|^U. 

3. 

Ml 2 IrOII 2iCH/H, 

^Ol Ml 2 121 Ul§?|3 oj EH Hil 01 

£^l Ml 1 §2J U|^?-|3 eiEifillOI^ 3FH2I §S NIC S CH^ ofUM S^6f£i. e& NIC£ jjj 2 §£] Ul^?-I3 21 Ei 31 01 ± 3hE£] 

Ul^?-ia^£j g&OII LUel i>3§aS M&&0II °I6H ^Pl Ml 2 »2| L1IM?-j3 eiEHIHIOl^ 3 r H2| 2L|Eii! NICOI 4S°f DH^JOII CH& g& DH 

^,^1 g^Ei §s Nice gsH ui^^as smb ^§ ^S2S 6^ ui^?-ia se»^xi M±m. 
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%=?m 4. 

HI 1 %i SES= HI 2 SEfe HI 3 S §2| OiJ^ & &0II SiCK/H. 
&;>l HIM^b ijoigxi AI^UOI: 

£JCH£ sm 0|^2| e& NIC°£¥E) UIM?-I3S UIM?I3 °» El til El (SNA) ^ Wl£ iJ (Session KillJS 4186^1 9\& ilHSISs 

£^1! (Routing) offer g& 3II0I e?||0|(Gateway)§ CH S&8^ 21 § ?S2£ Slfe Uie^a £12! If XI Al^g 

5. 

HI 1 m SE= HI 2 & SEfe HI 3 & g2| CH ^ & &0II &0iAt. 

£DI HI 1 §21 LilS^ia Si £151101^9^21 2UEHS NICHI- g& NIC0I SJxll°J Jf a§o^ gjfe SS&XI A|±gJ. 

6. 

HI 1 » ££fe HI 2 9 SEfe HI 3 & §21 CH i= © ST Oil &!CHA). 

HI 1 §2) H|e?-|3 £J El IHI 01 ^3^21 EUEHg NIC2I- §3 NICOI 2|2| SEISICH 318 ^S2£ Shfe U|e°|a g°J&JC| Al^gj. 



E£ 1 



A|>:gJ(NIDS) 



NIMH 



M|i=*|rl 
(NIC) 



L2 
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